Browse CVEs by Ecosystem and Severity

DeepSeek TUI has SSRF via HTTP Redirect Bypass in fetch_url Tool

Anchor: Program<'info, System> is not properly validated

smallbitvec: Integer overflow in safe API leads to heap buffer overflow

Zebra has Permanent Block Discovery Halt via Gossip Queue Saturation and Syncer Poisoning

Zebra v4.4.0 still accepts V5 SIGHASH_SINGLE without a corresponding output

Zebra's Transparent SIGHASH_SINGLE Handling Diverges from zcashd for Corresponding Outputs

Zebra has Consensus Divergence in Transparent Sighash Hash-Type Handling due to Stale Buffer

Zebra Vulnerable to Allocation Amplification in Inbound Network Deserializers

Zebra's Block Validator Undercounts Coinbase and P2SH Sigops

gix-fs: Symlink prefix-reuse allows worktree escape during checkout

scim_proto and kanidm_proto have an authenticated process abort via SCIM filter stack exhaustion

rmcp Streamable HTTP server transport has a DNS rebinding vulnerability

Tauri has an Origin Confusion Issue that Allows Remote Pages to Invoke Local-Only IPC Commands

rust-openssl has undefined behavior in X509Ref::ocsp_responders for certificates with non-UTF-8 OCSP URLs

RustFS: ListServiceAccount authorizes against wrong admin action, enabling cross-user enumeration and root service account takeover

gix and gitoxide: unvalidated submodule name traverses out of .git/modules and redirects state() / open() to another repository

gix and gitoxide's symlinked .gitmodules are followed and parsed from outside of the repository

gix-pack has multiple DoS vectors: unchecked indexing panics and uncapped OOM allocations from crafted pack data

gitoxide: CommandForbiddenInModulesConfiguration Bypass in gix_submodule::File::update() Enables Arbitrary Command Execution via .gitmodules

gix's submodule name validation bypass + trust inheritance flaw enables path traversal and credential disclosure

gix-transport: HTTP credentials leaked to redirected host in curl backend

awslabs/tough is Missing Delegated Metadata Validation

Hickory DNS's Record Cache Accepts AUTHORITY-Section NS from Sibling Zone via Parent-Pool Zone-Context Elevation

rustls-webpki: Denial of service via panic on malformed CRL BIT STRING

Grid: Integer Overflow in Grid::expand_rows Leads to Safe-API Undefined Behavior

russh has pre-auth DoS via unbounded allocation in its keyboard-interactive auth handler

Lemmy has SSRF in /api/v3/post via Webmention dispatch

Lemmy has SSRF and internal image disclosure in post link metadata via unvalidated og:image

rust-openssl: Deriver::derive and PkeyCtxRef::derive can overflow short buffers on OpenSSL 1.1.1

rust-opennssl has an Out-of-bounds read in PEM password callback when returning an oversized length

rust-openssl has incorrect bounds assertion in aes key wrap

rust-openssl: rustMdCtxRef::digest_final() writes past caller buffer with no length check

rust-openssl: Unchecked callback length in PSK/cookie trampolines leaks adjacent memory to peer

RustFS: Missing admin authorization on notification target endpoints allows unauthenticated configuration of event webhooks

nimiq-transaction: UpdateValidator transactions allows voting key change without proof-of-knowledge

nimiq-primitives: Node crash due to missing interlink validation in election macro block proposals

nimiq-block has skip block quorum bypass via out-of-range BitSet indices & u16 truncation

uutils coreutils has a Time-of-check Time-of-use (TOCTOU) Race Condition

uutils coreutils has a Time-of-Check to Time-of-Use (TOCTOU) race condition

uutils coreutils has a Time-of-check Time-of-use (TOCTOU) Race Condition

uutils coreutils has an Untrusted Search Path

uutils coreutils has a Time-of-check Time-of-use (TOCTOU) Race Condition

uutils coreutils doesn't properly handle setuid and setgid bits when ownership preservation fails

Brillig: Heap corruption in foreign call results with nested tuple arrays

Zebra Vulnerable to Consensus Divergence in Transparent Sighash Hash-Type Handling

Zebra Vulnerable to Denial of Service via Interrupted JSON-RPC Requests from Authenticated Clients

Zebra has rk Identity Point Panic in Transaction Verification

Zebra: Cached Mempool Verification Bypasses Consensus Rules for Ahead-of-Tip Blocks

thin-vec: Use-After-Free and Double Free in IntoIter::drop When Element Drop Panics

SP1 V6 Recursion Circuit Row-Count Binding Gap